2026 CVEs (page 192)
Page 192 of 471 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57322 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in weMail <= 2.1.2 versions. |
CVE-2026-57321 | High | 7.1 | 2026-06-26 | Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions. |
CVE-2026-57319 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions. |
CVE-2026-57318 | Medium | 6.5 | 2026-06-26 | Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions. |
CVE-2026-57317 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions. |
CVE-2026-57316 | Medium | 6.5 | 2026-06-26 | Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions. |
CVE-2026-57315 | High | 8.5 | 2026-06-26 | Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions. |
CVE-2026-57314 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions. |
CVE-2026-57313 | Medium | 6.5 | 2026-06-26 | Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions. |
CVE-2026-57312 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions. |
CVE-2026-56773 | High | 8.8 | 2026-06-26 | Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenticated user to bypass authorization checks. Attackers can re… |
CVE-2026-56072 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions. |
CVE-2026-56070 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions. |
CVE-2026-56069 | High | 7.5 | 2026-06-26 | Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions. |
CVE-2026-56068 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions. |
CVE-2026-56067 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions. |
CVE-2026-56066 | Medium | 5.8 | 2026-06-26 | Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions. |
CVE-2026-56064 | High | 8.5 | 2026-06-26 | Subscriber SQL Injection in Tourfic <= 2.22.5 versions. |
CVE-2026-56063 | High | 8.3 | 2026-06-26 | Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions. |
CVE-2026-56062 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions. |
CVE-2026-56061 | High | 7.5 | 2026-06-26 | Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions. |
CVE-2026-56060 | High | 7.5 | 2026-06-26 | Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 versions. |
CVE-2026-56059 | Critical | 9.9 | 2026-06-26 | Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions. |
CVE-2026-56058 | Critical | 9.9 | 2026-06-26 | Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions. |
CVE-2026-56057 | Critical | 9.8 | 2026-06-26 | Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions. |
CVE-2026-56055 | High | 8.8 | 2026-06-26 | Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions. |
CVE-2026-56048 | Medium | 6.5 | 2026-06-26 | Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 versions. |
CVE-2026-56047 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions. |
CVE-2026-56046 | Medium | 6.5 | 2026-06-26 | Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions. |
CVE-2026-56045 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions. |
CVE-2026-56044 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Blog2Social <= 8.9.2 versions. |
CVE-2026-56043 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Customer Reviews for WooCommerce <= 5.110.1 versions. |
CVE-2026-56041 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versions. |
CVE-2026-56040 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Gutenverse Form <= 2.4.7 versions. |
CVE-2026-56039 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Quick Interest Slider <= 3.1.6 versions. |
CVE-2026-56038 | High | 8.8 | 2026-06-26 | Contributor Privilege Escalation in Frisbii Pay <= 1.8.2 versions. |
CVE-2026-56036 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions. |
CVE-2026-56035 | High | 8.6 | 2026-06-26 | Unauthenticated Multiple Vulnerabilities in BitFire Security <= 5.0.3 versions. |
CVE-2026-56034 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions. |
CVE-2026-56033 | Critical | 9.8 | 2026-06-26 | Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions. |
CVE-2026-56032 | Critical | 9.8 | 2026-06-26 | Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions. |
CVE-2026-56031 | High | 8.1 | 2026-06-26 | Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 versions. |
CVE-2026-56030 | Critical | 9.8 | 2026-06-26 | Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions. |
CVE-2026-56029 | High | 7.5 | 2026-06-26 | Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions. |
CVE-2026-56028 | Critical | 9.8 | 2026-06-26 | Unauthenticated Privilege Escalation in Easy Elements for Elementor – Addons & Website Templates <= 1.4.9 versions. |
CVE-2026-56027 | Critical | 9.9 | 2026-06-26 | Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions. |
CVE-2026-56026 | Medium | 6.4 | 2026-06-26 | Subscriber Server Side Request Forgery (SSRF) in utm.codes <= 1.9.0 versions. |
CVE-2026-56025 | High | 7.5 | 2026-06-26 | Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions. |
CVE-2026-56011 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in MapPress Maps for WordPress <= 2.97.3 versions. |
CVE-2026-56010 | High | 8.8 | 2026-06-26 | Subscriber Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions. |
CVE-2026-56008 | High | 8.8 | 2026-06-26 | Contributor Privilege Escalation in Fusion Builder <= 3.15.4 versions. |
CVE-2026-54847 | High | 7.5 | 2026-06-26 | Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions. |
CVE-2026-54846 | High | 7.5 | 2026-06-26 | Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versions. |
CVE-2026-54840 | High | 7.3 | 2026-06-26 | Unauthenticated Broken Access Control in Newsletters <= 4.13 versions. |
CVE-2026-54839 | High | 7.5 | 2026-06-26 | Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 versions. |
CVE-2026-54837 | High | 7.5 | 2026-06-26 | Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions. |
CVE-2026-54835 | High | 7.5 | 2026-06-26 | Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions. |
CVE-2026-54834 | High | 7.5 | 2026-06-26 | Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions. |
CVE-2026-54833 | High | 7.4 | 2026-06-26 | Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions. |
CVE-2026-54832 | High | 7.5 | 2026-06-26 | Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions. |
CVE-2026-54831 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions. |
CVE-2026-54827 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions. |
CVE-2026-54826 | High | 7.6 | 2026-06-26 | Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions. |
CVE-2026-54825 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in wpDataTables <= 7.4 versions. |
CVE-2026-54824 | High | 7.5 | 2026-06-26 | Unauthenticated Sensitive Data Exposure in Ads by WPQuads <= 3.0.3 versions. |
CVE-2026-54820 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions. |
CVE-2026-52701 | Medium | 6.5 | 2026-06-26 | Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions. |
CVE-2026-4339 | Medium | 6.5 | 2026-06-26 | Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, 11.5.x <= 11.5.6 fail to validate attachment URLs against internal or private IP ranges in the Matte… |
CVE-2026-45257 | High | 7.8 | 2026-06-26 | The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumption does no… |
CVE-2026-45256 | Medium | 5.5 | 2026-06-26 | When used to deliver a signal to a specific thread, thr_kill2(2) called p_cansignal() to determine whether the operation was permitted but did not check the re… |
CVE-2026-3472 | Low | 3.5 | 2026-06-26 | Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, 11.5.x <= 11.5.6 fail to properly apply markdown image rendering restrictions to AI bot tool result… |
CVE-2026-30041 | High | 7.5 | 2026-06-26 | An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via… |
CVE-2026-30040 | Medium | 6.5 | 2026-06-26 | A heap overflow in the FSViewer.exe process of FastStone Image Viewer v8.3 allows attackers to cause a execute arbitrary code in the context of the current pro… |
CVE-2026-24547 | Medium | 5.3 | 2026-06-26 | Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions. |
CVE-2026-57940 | | 2026-06-26 | HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import functionality. The function get_feed() in system/admin/admin.php… | |
CVE-2026-57926 | Low | 2.6 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack |
CVE-2026-57925 | Medium | 4.3 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags |
CVE-2026-57924 | Medium | 4.3 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details |
CVE-2026-57923 | Medium | 5.3 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings |
CVE-2026-57922 | Low | 3.1 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible |
CVE-2026-57921 | Medium | 4.3 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint |
CVE-2026-53914 | Medium | 6.7 | 2026-06-26 | In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata |
CVE-2026-13426 | Medium | 5.4 | 2026-06-26 | The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths w… |
CVE-2026-57920 | High | 7.7 | 2026-06-26 | Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} endpoints. |
CVE-2026-57915 | High | 7.3 | 2026-06-26 | It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recomme… |
CVE-2026-40711 | High | 8.0 | 2026-06-26 | Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi-powerflex v2.16.0, csi-powermax v2.16.0, contain(s) an Improper… |
CVE-2026-57914 | Medium | 6.5 | 2026-06-26 | By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a StackOverFlow Exception which can lead to denial of s… |
CVE-2026-57620 | Medium | 6.5 | 2026-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor allows Stored XSS… |
CVE-2026-57918 | High | 7.1 | 2026-06-26 | libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS ser… |
CVE-2026-57913 | High | 7.5 | 2026-06-26 | Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing of meeting minutes and transcripts. |
CVE-2026-57912 | High | 7.5 | 2026-06-26 | Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about students by interviewers. |
CVE-2026-57473 | | 2026-06-26 | A vulnerability exists in the netclient and factory services of Reolink Home Hub (versions prior to v3.3.0.456_26031911) due to the possibility of brute-force… | |
CVE-2026-6658 | Medium | 5.4 | 2026-06-26 | A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `d… |
CVE-2026-1869 | Medium | 6.5 | 2026-06-26 | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin… |
CVE-2026-11702 | High | 7.5 | 2026-06-26 | Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then t… |
CVE-2026-11625 | High | 7.5 | 2026-06-26 | Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the f… |
CVE-2026-57881 | Critical | 9.8 | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is cau… |
CVE-2026-57880 | Critical | 9.8 | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caus… |
CVE-2026-57879 | Critical | 9.8 | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caus… |
CVE-2026-57878 | Critical | 9.8 | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is ca… |